After three years of advertisers battling Do Not Track, their shift represents a "win," said security and privacy researcher Christopher Soghoian in a blog post. Notably, the Do Not Track initiative has been backed by Google, Microsoft, and Yahoo, as well as the Digital Advertising Alliance (DAA), which counts almost 90% of the firms that engage in online behavioral tracking as members.

But questions remain. In an election year, pushing legislation to enforce Do Not Track would be difficult, according to Justin Brookman, the director for the non-profit civil liberties group Center for Democracy and Technology's Project on Consumer Privacy. Accordingly, the White House is encouraging online advertisers to agree to its new consumer privacy framework. Such an agreement would allow the Federal Trade Commission to then monitor and enforce compliance.

In other words, as it now stands, the Do Not Track proposal only goes so far, and has been built on some compromises. Here's why:

1. Demonstrating Do-Not-Track Desire Easy

How did Do Not Track come about? Soghoian said that he and Mozilla's Sid Stamm created a prototype in 2009 as a Firefox add-on, which added these two headers to outgoing HTTP requests: "X-Behavioral-Ad-Opt-Out: 1" and "X-Do-Not-Track: 1." Simple, right?

2. Advertisers Prefer Tracking

While signaling intentions sounds straightforward, how those intentions can and should be interpreted is open to debate. Or as Mike Zaneis, senior VP of industry trade group the Interactive Advertising Bureau, has put it, "It's like sending a smoke signal in the middle of Manhattan; it might draw a lot of attention, but no one knows how to read the message."

3. What's Coming: Browser Opt-Outs

Thanks to growing criticism of online tracking, the DAA said it will now encourage all companies engaged in online behavioral advertising to commit to the new Do Not Track principles, which include informing consumers about how their data is being collected, as well as how they can opt out. At the same time, however, the group has also promised to educate consumers about how online tracking helps support "the free content, products, and services you use online."

4. Browsers Won't Be Tracked

While any step toward the advertising industry committing to some type of Do Not Track mechanism is welcome, it's only a first step. "The DAA members have committed to respect 'Do Not Track' instructions with respect to targeted advertising implemented through browser settings," said privacy expert and attorney Christopher Wolf of Hogan Lovells in a blog post.

While Do Not Track sounds great on paper, some pundits have warned that it's still up to browser makers to decide what a Do Not Track button will do. Mozilla, however, has said that it's "firmly committed" enabling users to opt out of whatever they want to opt out of. Google, meanwhile, said that its Chrome browser will "adopt a broadly consistent approach" to the Do Not Track proposals. Of course then it will still be up to consumers to actually press such a button.

7. Should You Trust A Browser Button?

Regardless of whether the online advertising industry's self-regulatory approach to allowing consumers to opt out of being tracked works or not, there are other steps that Internet users can take. Notably, numerous browser add-ons and features, such as Ghostery and Internet Explorer's TPL will help users see how they're being tracked, and block such behavior.

Security professionals often view compliance as a burden, but it doesn't have to be that way. In this report, we show the security team how to partner with the compliance pros. Download the report here. (Free registration required.)

Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.

Published: 2017-05-09NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.